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VOLUME IV 
IN THE UNITED STATES ARMY 

UNITED STATES 
VS. 

MANNING, Bradley E., PFC COURT-MARTIAL 
U.S. Army, xxx-xx-9504 

Headquarters and Headquarters Company, 

U.S. Army Garrison, 

Joint Base Myer-Henderson Hall, 

Fort Myer, VA 22211 

/ 

The Hearing in the above-entitled matter was 
held on Monday, June 10, 2013, at 9:30 a.m., at 
Fort Meade, Maryland, before the Honorable Colonel 
Denise Lind, Judge . 
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DISCLAIMER 

This transcript was made by a court 
reporter who is not the official Government reporter, 
was not permitted to be in the actual courtroom where 
the proceedings took place, but in a media room 
listening to and watching live audio/video feed, not 
permitted to make an audio backup recording for 
editing purposes, and not having the ability to 
control the proceedings in order to produce an 
accurate verbatim transcript . 

This unedited, uncertified draft 
transcript may contain court reporting outlines that 
are not translated, notes made by the reporter for 
editing purposes, misspelled terms and names, word 
combinations that do not make sense, and missing 
testimony or colloquy due to being inaudible to the 
reporter . 
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PROCEEDINGS, 

THE COURT: Court is called to order. Mr. Fein, 
please account for the parties . 

MR. FEIN: Your Honor, all parties present when the 
court last recessed are again present with the following 
exceptions: Mr. Robert Shaw, court reporter's absence; Mr. 
Chavez, court reporter who is present previously; Captain 
Overgaard is absent, and Captain Morrow and Captain Whyte are 
present . 

THE COURT : All right . Thank you . 

Let ' s begin with any housekeeping . Have we had 
anything marked as an appellate exhibit, as a defense exhibit 
or a prosecution exhibit? 

MR. FEIN: Yes, ma'am. A moment. 

Your Honor, first the parties agreed to a 
stipulation of expected testimony from Mr. Steven Buchanan, 
dated 9 June 2013 and this has been marked as prosecution 
exhibit 69 for identification. 

THE COURT: All right. PFC Manning, do you have a 
copy of prosecution exhibit 69? 

THE ACCUSED: Yes, Your Honor. 
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THE COURT: And we have had this discussion on other 
stipulations of expected testimony and will have this 
discussion probably several times again I believe in the 
course of this court-martial, but with this particular 
stipulation of a Mr. Steven Buchanan dated 9 June 2013, it 
consists of four pages . Is that your signature on the last 
page? 

THE ACCUSED: Yes, ma'am. 

THE COURT : Before signing this stipulation did you 
read it thoroughly. 

THE ACCUSED: I did, Your Honor. 

THE COURT: Do you agree with the contents of the 
stipulation? 

THE ACCUSED: Yes, ma'am. 

THE COURT: Before signing this stipulation, did 
your defense counsel explain the stipulation to you? 
THE ACCUSED: Yes, ma'am. 

THE COURT: Do you have any questions about the 
stipulation? 

THE ACCUSED: No, Your Honor. 

THE COURT: Do you understand that you have an 
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absolute right to refuse to stipulate to the contents of this 
document? 

THE ACCUSED: I do, Your Honor. 

THE COURT : Do you understand you should enter into 
this stipulation only if you believe it ' s in your best 
interest to do that? 

THE ACCUSED: Yes, Your Honor. 

THE COURT: And once again, I want you to understand 
how this stipulation is going to be used. It's a stipulation 
of expected testimony, and what that means is when counsel 
for both sides and you agree to a stipulation of expected 
testimony, you are agreeing that if Mr. Steven Buchanan were 
here in court sitting on the witness stand and under oath 
that Mr . Buchanan would testify substantially as to what is 
in this stipulation of expected testimony? 

THE ACCUSED: Yes, Your Honor. 

THE COURT : And his testimony can be contradicted, 
attacked or explained the same way as if he was testifying 
here live in court, and you're not admitting to the truth of 
the person ' s testimony? 

THE ACCUSED: Yes, ma'am. 
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THE COURT: And knowing what I told you and what 
your defense counsel earlier told you about this stipulation, 
do you still want to enter into this stipulation of expected 
testimony? 

THE ACCUSED: Yes, ma'am. 

THE COURT: Counsel for both sides agree to the 
stipulation and its content? 

MR. FEIN: Yes, ma'am. 
MR. HURLEY: Yes, ma'am. 

THE COURT: Prosecution exhibit 69 is admitted. 

MR. FEIN: Your Honor, also on 5 June 2013 what has 
been marked as appellate exhibit 564, United States filed its 
witness list order and proposed stipulations for the 
prosecution witnesses for the remainder of the government's 
case in chief. 

THE COURT : All right . As I understand it , the 
parties are still working on some of those stipulations? 

MR. FEIN: Yes, ma'am. Although there are many 
stipulations that are annotated by both parties on this 
filing, we are working and probably the next recess we'll 
have many more of these signed and ready for the court to go 
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over with the accused. 

MR. COOMBS: Ma'am, as part of the 802 session we 
discussed if the government were to add anyone on to this 
list they would give the defense a 24 hour notice. 

MR. FEIN: Yes, ma'am. And the United States 
acknowledges that . 

THE COURT : All right . Any other housekeeping 

matters? 

MR. FEIN: Yes, ma'am. 

Ma'am, as of this morning the media operations 
center consists of 11 journalists and two stenographers . The 
theater is not currently being used. And the overflow 
trailer is also not currently being used although available 
and up to 30 seats . 

THE COURT: All right. And once again, for the 
record, up to this point in time of the trial have any 
members of the public been specifically excluded based on the 
court ' s order? 

MR. FEIN: No, ma'am. 

THE COURT : All right . Thank you . Does defense 
have any reason to disagree? 
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MR . COOMBS : No , Your Honor . 

THE COURT: Any other matters for housekeeping? 

MR. FEIN: No, ma'am. 

MR. COOMBS: No, Your Honor. 

THE COURT : All right . The government proposed 
trial schedule plan, I announced at the beginning of the 
trial that we would try it out for a week and see how it 
worked. We had a little fluctuation last week because we 
recessed early, but that's at appellate exhibit 551. There 
was no defense objection. The court will approve that 
proposed trial plan, it certainly may be modified as we go 
along depending on necessity, but for now it provides a good 
rough schedule on how we will proceed, usually starting 0930 
in the morning, ending approximately at 5:30 or six o'clock 
at night depending on the status of the particular witness 
who is on the stand. 

Any issues with appellate exhibit 551? 

MR . COOMBS : No , Your Honor . 

MR. FEIN: No, ma'am. 

THE COURT : All right . Next we have appellate 
exhibit 563 and, for the record, counsel and I entered into a 
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RCM 802 conference this morning. Once again, that's a 
conference where I discuss scheduling and logistics that 
arise in cases . One of the issues that came up was any 
change that came up to the government's witness list that Mr. 
Coombs has already mentioned. 

Another was appellate exhibit 563 which is the 
request from the Freedom of the Press Foundation that was 
addressed to myself and Major General Linnington who is the 
commander of the United States Military District of 
Washington with respect to credentialing two stenographers 
to, an overlap of two stenographers to report, to create an 
unofficial transcript of this trial which they intend to 
broadcast that will be available to all media outlets and the 
public is what this letter tells me . Mr . Coombs advised me 
that the defense would like to comment . 

MR. COOMBS: Yes, Your Honor. Just briefly. 

We believe that this enforces PFC Manning's Sixth 
Amendment right to a public trial and also impacts on a First 
Amendment right for the press to accurately keep track of 
what happens in the court-martial . Our understanding is that 
the government now is assuring that the stenographers will 
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have access during non-peak times, and then during peak times 
they are looking into whether they'll have access at the MOC 
or not. It appears that regardless of whether it's peak or 
non-peak they're going to be given an access pass instead of 
credential passes. 

And then I know that we still have an outstanding 
issue on whether or not the government can accommodate the 
requests to have one of the stenographers come in at 0700 and 
another come in during the afternoon session to where we 
don ' t have a requirement for both of the stenographers to be 
present the entire day. 

THE COURT: All right. Major Fein, would you like 
to be heard? 

MR. FEIN: Ma'am, the United States after the RCM 
802 and based off of questions defense has asked owes the 
court and defense some answers to questions . One is can the 
overflow trailer be used as an area for a stenographer versus 
the media operations center and, second, the logistics of 
actually having an individual escorted on or off post and 
we'll get both those questions answered today, Your Honor. 

THE COURT : All right . Thank you . 
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Just for the record, while the court is not 
interested in getting into the area of who is credentialed 
and who isn't credentialed as it's beyond the scope of this 
trial, the court does note and so advised the parties in the 
RCM 802 that rules of court-martial are not structured to 
provide a contemporaneous transcript of proceedings . In 
light of the public interest in this case, in light of the 
unique circumstances of this case, in light of the assertion 
by PFC Manning that this stenographer procedure will further 
his rights to a Sixth Amendment right to a public trial and 
also obviously further the public ' s First Amendment right to 
a public trial, the court has ordered the government to 
arrive at some kind of accommodation to allow stenography of 
the proceedings of this trial and the creation of, I guess 
what their intent is an unofficial transcript, certainly not 
an official transcript, the government's not doing it. So 
the government's in the process of making that arise. And 
just for the record, this rule or this guidance of the court 
can always be reconsidered should there be a violation of the 
rules of court with respect to audio broadcasting or visual 
broadcasting once these procedures are put into place . 
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Does either side desire to address this issue any 

further? 

MR. FEIN: No, Your Honor. 
MR . COOMBS : No , ma ' am . 

Ma'am, before we go on, could we please correct one 
exhibit for the record? 

THE COURT: Certainly. 

MR. FEIN: Earlier the court when discussing the 
government ' s proposed trial schedule plan referenced 
appellate exhibit 551. The actual proposed trial schedule 
plan is 553 Alpha. 

THE COURT: All right. Does the defense agree? 

MR. COOMBS: I'll have to take Major Fein's word for 
it, ma'am, I don't have the appellate exhibits in front of 
me . 

THE COURT: All right. 553 Alpha and that's the 
government's proposed trial schedule dated 21 May 2013, is 
that correct? 

MR. FEIN: Yes, Your Honor. 

THE COURT : Okay . That ' s the court ' s mistake . 
The court is prepared to rule on the request for 
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public access or in the alternative motion to intervene to 
vindicate right to public access. On 3 June 2013 the court 
received appellate exhibit 558 of a proposed motion to 
intervene under rules for court-martial, 806A, B and C by 
three individuals who are not parties to the trial . Neither 
the government nor the defense have moved to file appellate 
exhibit 558 as a motion with the court . 

Findings . One . The proceedings have been open to 
the public since the start of the trial . The court has made 
particularized findings as required by 806B with respect to 
those portions of the trial that must be closed to protect, 
appellate exhibit 550. 

Two. Neither the court nor anyone acting pursuant 
to order of the court has specifically excluded any person 
from observing the proceedings either in court or in a 
designated overflow area. 

Three . Reasonable policies and procedures for media 
registration and credentialing have been established and 
published by the Military District of Washington as set forth 
in appellate exhibit 561. 

Four. 806C prohibits photography and broadcasting 
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to include audio and video recording. 

Five . The two parties to this trial are the United 
States and PFC Manning. Unless authorized by the rules for 
court-martial, or in special circumstances recognized by the 
Court of Appeals for the Armed Forces, only parties to the 
trial have standing to file motions to be considered by this 
court. ABC Inc. versus Powell, Court of Appeals for the 
Armed Forces, 1997. 

Ruling. The court declines to consider appellate 
exhibit 558 as it is from three individuals who are not 
parties to the trial and who under the circumstances lack 
standing to file a motion with the court . 

I ' 11 have this marked as the next appellate exhibit 

in line . 

Is there anything else we need to address at this 
point before going forward with the merits of the trial? 

MR . COOMBS : No , Your Honor . 

MR. FEIN: No, Your Honor. 

THE COURT: Government, proceed. 

MR. FEIN: Ma'am, the United States offers Mr. 
Buchanan's stipulation to be read into the record. 
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THE COURT: Proceed. 

MR. FEIN: Stipulation of expected testimony of Mr. 
Steven Buchanan, 9 June 2013. 

It is hereby agreed by the accused, defense counsel 
and trial counsel that if Mr . Steven Buchanan were present to 
testify during the merits and presentencing phases of this 
court-martial he would testify substantially as follows : 

I work as a contractor for the National Security 
Agency, NSA. I provide support to Intelink . Intelink is a 
software suite operating on U.S. government private networks 
which provides Internet-like services to enable collaboration 
between intelligence agencies within the United States 
government . 

Primarily it includes a web-based search engine of 
unclassified, secret and top secret information systems . It 
hosts blogs and allows for messaging, sharing files and 
searching for unclassified, secret and top secret information 
across agencies, to include Intellipedia for online 
collaboration and passport account management . 

In my current position I provide security for 
Intelink and serve as the assurance IA manager. This means I 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Morning Session 

18 

make sure the systems work as intended. I work to make sure 
the systems are properly maintained and guard against their 
misuse . I have worked in this role for five years . 

Prior to holding my current position from 1999 to 
2008 I was an information systems security engineer for 
Intelink. In this position I made sure the systems are built 
correctly to perform their intended connection, search and 
storage functions . Before that I worked in systems support 
within the intelligent community, IC. In total I have worked 
in the IA industry supporting different industries in the IC 
since 1985. 

I have two primary IA and information systems 
certifications — excuse me — certifications. First, I am a 
certified information systems security professional, CISSP. 
This means I've heightened experience in the knowledge of 
information security. CISSP is a globally recognized 
standard of achievement that confirms an individual ' s 
knowledge in the field of information security. This 
training covers all parts of information security including 
personnel and building securities aspects. 

CISSP indicates that an individual has attained 
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specialized knowledge in the field of IA in accordance with 
standards articulated and in Department of Defense Direct 
Live . 

In addition to CISSP I also have the information 
technology infrastructure library, ITIL, foundation 
certification . ITIL is the most widely adopted framework for 
IT service management in the world. ITIL provides a 
framework on technology systems management, particularly on 
how to build information management systems and manage them 
with a specific process . 

In my role as an IA manager for Intelink, I am 
familiar with the audit logs created by Intelink . The 
Intelink maintains mansion and stores audit data through the 
course of its day to day operations . This data be can be 
used to respond to and monitor and maintain Intelink usage 
and performance . These logs are created anytime anyone makes 
a connection with a computer system. 

The system detects these connections with SERS, 
tracking the work station making the request of the system, 
how requests route through the system, and where the request 
ultimately gets the information. These connection logs are 
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made in real-time and stored in data files every hour . They 
are computer generated and only a very limited number of 
people have access to them. 

Intelink logs contain audit data captured from proxy 
servers that control access to Intelink servers and shows the 
work of users in systems that connect to and use the Intelink 
services while in a classified and unclassified network. 

We know that Intelink logs are accurate for several 
reasons: First, they write to a secure server; second, only 
limited personnel have access to them; third, they are 
reviewed by our team at least on a weekly basis to insure 
that the reporting processes are occurring properly, meaning 
to insure that the log data is being written properly. 

The log data is useful to us because it shows us how 
our services are being used, whether Intelink services are 
running properly and whether adjustments should be made. 

We can also use the data to solve technical issues, 
determine security risks and review data trends that help us 
develop our management strategies . 

We can tell if there are errors because information 
the logs normally collect would be missing. If a data file 
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has been corrupted while being written, it would not open. 
Missing or corrupt — missing or corrupt data files are 
regenerated from the system, so in short the data these 
systems logs have captured is complete and accurate. 

I am involved in this case because we received a 
request to pull Intelink audit logs given Intelink could have 
been used to gather information that was ultimately 
compromised . 

At that time we did not track users by log-in 
identifiers . Instead, we tracked usage by IP address . One 
of the log data requests was from the secret or — excuse me, 
ma'am — secure Internet protocol routing network, SIPRNET, 
IP address 22 dot 225 dot 41 dot 22 and 22 dot 225 dot 41 dot 
40 from October 2009 to June 2010. 

Intelink audit logs are stored on a Linux based 
system. To pull the requested log I performed a Linux search 
on the server . This means that I issued a line command 
telling the server what information I wanted to read. When 
the system returns the data, the system writes the data to a 
file. 

In reviewing the files returned I could find no 
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relevant information in the data files for October 2009 or 
June 2010. However, there was activity recorded for the 
relevant IP addresses for the months November 2009 through 
and including May 2010. 

I double-checked to make sure there was no activity 
from the relevant IP addresses during October of 2009, and 
then ran the search again to verify the results . 

The results of the second search match the results 
of my original search. The results are saved automatically 
as a dot TXT file so they are readable to the person running 
the query. When I received the response to my IP data query, 
I opened the file to make sure it was readable and that all 
the data had been reported properly. I did not alter the 
file in any way. 

I burned the file to a CD and then turned it over to 
Special Agent Mark Mander with Army CID . These logs are on 
the CDs marked prosecution exhibit 61 for identification. 
The file names on Intelink logs I have attested to showing 
activity for IP addresses 22 dot 225 dot 41 dot 22 are the 
following: J F 10 underscore 22 dot log, M A N 10 underscore 
22 dot text, and M D 09 underscore 22 dot log. 
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The file names of the Interlink logs that I attested 
to showing activity for IP address 22 dot 225 dot 41 dot 40 
are the following: J F 10 underscore 40 dot log, M A N 10 
underscore 40 dot TXT, N V 09 underscore 40 dot log. 

The file J F 10 underscore 22 dot log contains audit 
logs capturing data for the 22 dot 225 dot 41 dot 22 IP 
address in January and February 2010. 

The file M A N 10 underscore 22 dot text contains 
audit logs capturing activity for the 22 dot 225 dot 41 dot 
22 IP address in March, April and May 2010. 

The file N K 09 underscore 22 dot log contains audit 
logs capturing activity for the 22 dot 225 dot 41 dot 22 IP 
address in November and December 2009. 

I used the same file name structure to capture the 
contents of the audit logs associated with the 22 dot 225 dot 
41 dot 40 IP address. 

The particular log data I captured reported several 
things . I will use the following discrete line data to show 
by way of example to show what the Intelink logs mean . 

Excuse me, Your Honor. 

22 dot 225 dot 41 dot 40. 29 slash November slash 
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2009 colon 05 colon 10 colon plus 000, end bracket, quotation 
D E T slash Intelink dot W I P dot I S M C dot S gov dot gov 
slash web resource dot A X D question mark D equals A Z 7 K D 
R R C Q C L TV 13 Z G P 21 N Q 2 and T equals 

6336277576757031205 space HTTP slash 1.1, end quote, space 
200 space 6665, quotation mark, HTTP colon slash slash W W 
W dot Intelink dot S gov dot gov slash A S P X question mark 
Q equals H D Q A, end quote, space, quote, mozilla slash 5.0 
percent 20, open parentheses, Windows semicolon — excuse me, 
Your Honor — percent, 20 U semicolon percent 20 Windows 
percent 20 NT percent 20 dot 1 semicolon percent 20 E N dash 
U S semicolon percent twenty R V colon 1.9.1.2, end 
parentheses, percent 20 gecko slash 20090729 percent 20 
Firefox slash 3.5.2, end quote, space, quote, dash, quote. 

Excuse me, Your Honor. Hyphen, not dash. 

Paragraph eight . The significance of the above line 
that was pulled from Intelink is the following: The 22 dot 
225 dot 41 dot 40 is the IP address. This indicates that a 
computer with the IP address made the request for 
information. Essentially it provides an electronic location 
for the user using Intelink. 
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The 29 slash November slash 2009 colon 04 colon 10 
colon 50 ten plus 0000 is a date time group. The time zone 
is reflected as the offset from the Greenwich Mean Time, GMT. 
In this case plus 0000 shows no offset . 

The next entry is the action the user took . In this 
case, for example, you see, you see quote, get, end quote. 
This commands indicates the user is seeking particular 
information on SIPRNET through Intelink . The action reflects 
the user checking on something in the website . 

The next entry is the page being requested by the 
action above. Here it is, quote, slash Intelink W W I P dot 
S I M C dot gov dash A X D question mark D equals A Z 7 K D C 
CCLTV13ZGP21NQ2 and T equals 63362776 — excuse 
me. Your Honor, I'll repeat this number — 
633627756757031250 space HTTP slash 1.1, end quote. 
Intelink W I P dot M I S C dot gov is the registered name for 
Intelink which is on the SIPRNET, a secret government system. 

The code of numbers for all — excuse me — for the 
information tells you whether the user ' s request was 
successful and to what degree. For example, the code, quote, 
200, end quote, after particular information indicates that 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Morning Session 

26 

an Internet home page, HTTP, was successfully accessed. 
The quote, 6665, end quote, is the size in bytes of the 
information returned by the query. The entry HTTP colon 
slash WWW slash search default S S A S P X Q equals tells 
me the user searched for the term, quote, H D Q A on 
Intelink . 

In this entry, quote, search, end quote, is a 
specific Intelink service used and, quote, Q equals H D Q A, 
end quote, represents the search query entered into the 
search box on the Intelink web page on the specific computer 
with the IP address listed above. 

The entry, quote, mozilla slash 5.0, end quote, 
tells me the user of the SIPRNET computer with an IT address 
of dot 40 was using verse five of the mozilla Internet 
browser . Mozilla is a company that produced Internet browser 
software similar to Microsoft Explorer. The entry 20 
indicates a space in the line. The entry, quote, Windows 
semicolon percent 20 U semicolon percent 20 windows percent 
20 N T percent 205.1 semicolon percent 20 E N-U S semicolon 
20 R V colon 1.9.1.6 close parenthesis, end quote, tells me 
the user of the SIPRNET computer with an IP address of 22 dot 
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225 dot 41 dot 40 was using a Windows NT work station 
computer . 

The entry, quote, percent 20 gecko slash 20090729 
percent 20 Firefox 3 slash 5.2, end quote, tells me that the 
user of the SIPRNET computer with an IP address of dot 40 was 
using a version of the Firefox Internet browser version 
number 3.5.2. Firefox is a specific name of the Internet web 
browser program produced by the mozilla company. 

These Intelink logs only audit what happens on the 
Intelink system, so it can only tell you what a particular 
user IP address was doing when connected with the Intelink 
system. It would reveal Intellipedia searches and other ways 
the user's IP address used Intelink searches by showing what 
files within Intelink that IP address accessed. 

At the time users were not required to have Intelink 
passport accounts to use most Intelink services, including 
the SIPRNET Internet search and browsing. A SIPRNET Intelink 
passport account is a user name and password account 
established to allow access to some government websites . It 
is one of the many applications Intelink uses on its own 
internal systems to track what a user accesses . A user would 
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need an account if he wanted to contribute to Intelink 
services or access certain websites or databases on SIPRNET, 
but not just to conduct searches . 

To create an account a user would have to be on the 
SIPRNET, go to the account creation page and insert personal 
information such as name, contact and organizational 
information . The user is then notified via SIPRNET email 
with a code to use the first time he accesses the site. 
Other government organizations or websites and databases on 
SIPRNET use SIPRNET Intelink passport accounts before any 
user may access their information on SIPRNET. 

Our Intelink organization maintains and stores 
Intelink account passport profiles and registered Intelink 
users . In a response to a request by Army CID I looked 
Bradley Manning up in our system. Someone with the name, 
quote, Manning, comma, Bradley, space, E, end quote, did have 
an account. The user name of the individual was, quote, 
Bradley dot E dot Manning end quote . According to the user 
account, Bradley dot E dot Manning, his pay rate was E 4 and 
used an email address of Bradley dot Manning at U.S. dot Army 
dot mil . The user name is automatically generated based on a 
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common name used by the individual setting up the account . 
The user information identifies each identifying factor such 
as name, contact information security questions and answers 
the user inputs into the system at the time of the account 
creation . 

According to the passport account, the last time the 
user logged in was 27 April 2010 at 1805 and 46 seconds Zulu 
time. According to the passport account the registration 
date was 11 October 2008 . The password account information 
is marked as P C 62 for identification . I signed an 
attestation on 22 June 2012, Bates number 00505257, attesting 
to the authenticity of what have been marked as PE 61 and PE 
62 for identification and are the provided logs in the 
Intelink password account information for Bradley dot E dot 
Manning contained in the file Manning dot LDIV. 

Your Honor, the United States moves to admit 
prosecution exhibits 61 and 62 for identification as 
prosecution exhibits 61 and 62 . 

MR. HURLEY: No objection, ma'am. 

THE COURT: All right. Is prosecution exhibit 61 a 

CD? 
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MR. FEIN: Your Honor, two CDs, CD one of two and 
two of two . And 62 is a printout . 

Your Honor, may I have a quick moment? 
THE COURT: Yes. 

All right . Prosecution exhibits 61 and 62 are 

admitted. 

Handing it back to the court reporter. Government, 
are you ready to proceed? 

MR. FEIN: Yes, ma'am. 

MR. MORROW: Your Honor, the United States recalls 
Special Agent David Shaver. 
Whereupon : 

DAVID SHAVER, 

called as a witness, having been previously duly sworn 
according to law, testified as follows : 

DIRECT EXAMINATION 

BY MR. MORROW: 

Q. Special Agent Shaver, you are still under oath. 
A. Yes, sir. 

Q. Agent Shaver, I want to begin by talking about some 
SIPRNET Intelink logs collected as part of this case, but 
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first I need to ask a few preliminary questions . 

Did you examine any SIPRNET computers associated 
with PFC Manning as part of this investigation? 
A. Yes, sir, I did. 

Q. And what were the IP addresses of those computers? 

A. They were ending in dot 22 and dot 40. 

Q. And again for the record, what is an IP address? 

A. That's like a telephone number for a computer. 

Q. And are you familiar with Intelink? 

A. Yes, sir, I am. 

Q. And what is Intelink? 

A. It's Google of the SIPRNET. 

Q. And did you examine any logs collected from the 
SIPRNET Intelink site in this case? 
A. Yes, sir, I did. 

Q. And what did those logs contain generally? 

A. They generally contained the source IP, the computer 
making the request, date and time of the request and some of 
the search list . 

Q. Now, were the Intelink logs you examined all of 
Intelink or just associated with a particular IP? 
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A. They were just associated with dot 22 and dot 40. 
Q. And what time period roughly did the logs cover? 
A. November 2009 to May 2010. 

Q. And why was that time period collected as part of 
this case? 

A. Sir, that's when PFC Manning was in theater. 

Q. When you received the log files, what do you do; do 
you work off that copy or do you work off another copy? 

A. Sir, for ease of review for this case I took them 
and converted them to an Excel spreadsheet for ease of 
review . 

Q. Okay. So let's just back up a little bit though. 
In what form did you receive the log files? 
A. They were text files. 
Q. And what is a text file? 

A. Sir, it's just, just raw text, unformatted. 

Q. And so what did you do once you found or at least 
opened the files and they were text files, what did you do 
next? 

A. I imported them into Excel. 

Q. And generally why do log files come to you in text, 
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is that standard? 

A. Yes, sir, generally. 
Q. And why is that? 

A. Sir, just for ease of transferring information 
between one — for review and ease of transferring the data 
from one computer to another . Text is a common format for 
that. 

Q. And when you received the log files and text, if you 
had printed those text files — first let me ask this 
question. Was it one big file or several small file files? 

A. There are several smaller files. 

Q. If you had printed just one of those files, 
approximately how many pages would that have come out to? 

A. Quite a lot. Maybe a hundred or so, if not more. 

Q. And that's just for one log file? 

A. Yes, sir. 

Q. Now, you said you converted these text files into 
Excel? 

A. Yes, sir. 

Q. And once they were converted, if you had printed 
that entire log sheet essentially or all the logs for the 
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time period, how many pages are we talking about? 

A. A lot. Several hundred, if not more. 

Q. And in your line of work, do you regularly transfer 
text files from just the raw data format to Excel? 

A. Yes, sir. 

Q. And is that a difficult process? 
A. No, sir. 

Q. And when you transfer the information from text to 
the Excel spreadsheet, did you alter the information in any 
way? 

A. No, sir. 

Q . All right . So let ' s talk about the logs in the 
Excel format . Once you had them in that format , what did you 
do next? 

A. I wanted to determine since this is Google 
basically, I wanted to determine what keywords were used, 
what was, what keywords were entered and what was searched. 

Q. And how do you determine based on looking at the 
logs what searches were made from these computers? 

A. What I did is I went to Intelink on my SIPRNET 
computer and I did some keyword searches and then I requested 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Morning Session 



35 

my Intelink logs from my SIPRNET computer. 

Q. Now, when you say you requested your Intelink logs, 
did you have to go somewhere else to ask for — 

A. I had to put a request in. 

THE COURT : Just a moment . Yes . 

MR. TOOMAN: Your Honor, if the government would 
like to introduce the logs that Agent Shaver made, the 
defense will stipulate to that . 

THE COURT: You are laying a foundation? 
MR. MORROW: I need to explain to the court 
essentially what they are. 

THE COURT: That's fine. Go ahead. 
BY MR. MORROW: 

Q. So, again, the process of finding a search? 
A. Yes, sir. So I found the keywords that I searched 
for and then I went to the logs and determined there ' s a 
specific pattern that predates before the search, so once I 
figured out what the pattern is, the keyword followed it and 
I filtered it off of that. 

Q. So you used the pattern to then filter off the logs 
that you had already collected? 
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A. Correct. 

Q. And once you had that pattern identified into the 
raw logs essentially, what did you do next? 

A. I extracted all the keywords out as a separate tab 
on the Excel spreadsheet and then I started looking at what 
keywords were entered. 

Q. I am retrieving prosecution exhibit 81 for 
identification from the court reporter . 

Agent Shaver, if I could have you move to the panel 
box, please. 

A. Yes, sir. 

MR. MORROW: Your Honor, this exhibit already been 
shown to defense . 

THE COURT : All right . Thank you . I notice Captain 
Tooman nodding his head. 

MR. TOOMAN: Yes, ma'am. 
BY MR. MORROW: 

Q. I am handing the witness what has been marked as 
prosecution exhibit 81 for identification. 

Agent Shaver, if you could just take a moment and 
look that you that , please . 
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Agent Shaver, do you recognize that document? 
A. Yes, sir, I do. 
Q. And what is it? 

A. Sir, this is the keywords, the spreadsheet that I 
created that contains the keywords . 

Q. When you say keywords, again, what does that mean? 
What kind of activity is that capturing from the Intelink 
logs? 

A. Sir, if you went to the Intelink, it's a website, 
you would put a keyword in, cat, dog, it would log that, the 
word cat, and that's what I did was I pulled out those 
individual searches. So you, again, this is go to the 
website, you put in a keyword and hit enter. 

Q. And, Agent Shaver, did you create that document? 

A. Yes, sir. 

Q. And, again, is that an accurate summary of all of 
the Intelink searches on the SIPRNET from these two user 
accounts? 

A. Yes, sir. The two computers, sir. 
Q. Dot 22 and dot 40? 
A. Yes, sir. 
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Q. And when you extracted the searches from the full 
logs, did you alter the information in any way? 

A. I extracted out the information, but I did not alter 
them. 

MR. MORROW: Your Honor, at this time the 
prosecution moves to admit prosecution exhibit 81 for 
identification into evidence . 

MR. TOOMAN: No objection, Your Honor. 

THE COURT: Can I see it, please? 

Prosecution exhibit 81 for identification is 

admitted. 

MR. MORROW: I'm going to hand the exhibit back to 
the witness to ask a few questions . 
BY MR. MORROW: 

Q. Agent Shaver, can you generally just describe the 
information and the columns just, you know, the headers 
essentially left to right. 

A. Sure. Yes, sir. The first field would be a number 
field, that ' s something I put in there to make it easier so 
you can reference the number . 

The next field is IP address . 
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The next field is the date and time . 
The next field is the time zone . 
And the action, the keyword that was entered. 
Q. Now, when you say date, I'm sorry, when you say date 
and time, what do you mean by that, the date and time some 
word was searched? 
A. Yes. 

Q. And when was the first search by either one of those 
computers? 

A. It would be 10 November 2009. 
Q. And when was the last search? 
A. 7 May 2010. 

Q. And I want to talk about — actually, first, let me 
just ask this question. When was the first search for 
WikiLeaks in that summer? 

A. 1 December 2009. 

Q. And are there any other searches based on your 
review of those searches that you thought were of interest to 
the investigation that were odd in any way? 

A. Yes, sir. There were several that were odd, 
searches for things like Iceland and Julian Assange, they 
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seemed out of place . 

Q. And why do you say that? 

A. Sir, it is my understanding these computers were at 
FOB Hammer Iraq and should have been focused on events in and 
around FOB Hammer Iraq. 

Q. Thank you. I'm retrieving prosecution exhibit 81. 
Agent Shaver, you can move back to the witness box. 
Thank you. 

Agent Shaver, I want to talk about some of the 
searches for WikiLeaks and where they led on the SIPRNET . 
What happens when the user at one of the IP addresses 
searches through what comes back in the log? 

A. There would be some search hits. If the user then 
clicks on log files or clicks on a link, it will show that 
link that has been clicked and things of that nature . 

Q. Now, in this case at least for these SIPRNET logs, 
does the activity after the search, is that always captured? 

A. No, sir. 

Q. And why would sometimes there be gaps, sir? 
A. If the user went to a web page, entered Intelink, 
entered a search term and it was directed to a new web page, 
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in essence they're now on that web server, no longer part of 
the Intelink world. 

Q. Okay. I'm retrieving what's been marked as 
prosecution exhibit 45 for identification. 
THE COURT: Captain Tooman? 

MR. TOOMAN: I'm just standing up to look, Your 

Honor . 

BY MR. MORROW: 

Q. I'm handing the witness what has been marked as 
prosecution exhibit 45 for identification. 

Agent Shaver, just take a look at that, please. 
Do you recognize that document? 
A. Yes, sir, I do. 
Q. And what is it? 

A. It's the Army Counter Intelligence Center report on 
WikiLeaks . 

Q. And was this document accessible via the SIPRNET? 
A. Yes, sir. 

Q. And based on your review of the Intelink logs, did 
any searches for WikiLeaks lead to the discovery or the 
access of this document on the SIPRNET? 
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A. Yes, sir. 

Q. And how did you go about identifying this particular 
document in the Intelink logs? 

A. This document was provided to me for examination to 
compare against a document that was released by WikiLeaks, 
and the original document that was provided to me a unique 
name was provided. 

Q. So it wasn't titled at least whatever the title of 
the document was? 

A. No, sir. 

Q. Do you recall what the title was? 

A. It started with R B O 8 and there were some numbers 
after that . 

Q. Okay. I am retrieving prosecution exhibit 45 for ID 
from the witness and I am retrieving, again, prosecution 
exhibit 84 for identification from the court reporter. 

I am handing the witness what has been marked as 
prosecution exhibit 84 for identification to the witness. 

Agent Shaver, do you recognize that document? 
A. Yes, sir, I do. 
Q. And what is it? 
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A. This is another document I created based upon the 
searches for the R B document from the Intelink logs . 

Q. So what does that document show essentially? 

A. It shows four different times in which the IP dot 40 
viewed or attempted to view the R B document . 

Q. Okay. I'm retrieving — first can we publish this 
to the court, Your Honor? 

THE COURT: Proceed. 
BY MR. MORROW: 

Q. Agent Shaver, I want to start with line one. Can 
you just describe for the court the activity, the action on 
the very far right, please? 

A. Yes, sir. You see the last — how do you clear it? 

Q . Don ' t worry about that . 

A. The line I've managed to — there you go. Thank 
you, sir. 

The last line there you see it says H T T P W W W 
Intelink S dot gov search default, Q equals WikiLeaks, that 
was the search query for this, the search terms WikiLeaks was 
used, and these are the, the result was this document. And 
if, again, if you look at that third from the bottom it says 
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the address, dot north dot Army not smil dot mil, a little 
further down you see the document itself, R B 8 dot AST 
P, and a little further to the right you see where it was 200 
and then there's numbers at the end. 200 means it's 
successful, this document was viewed. 

Q . And what ' s a dot ASP? 

A . That ' s like a web page . 

Q. In lines 2, 3 and 4, do you see the, is there also a 
successful access in those cases? 

A. No, sir. The 302, it's a redirect, so at this time 
if they clicked on that link looking for that specific 
document, it went somewhere else. 

Q. Okay. So you can't tell if that was successful 
access of that document? 

A. No, sir. 

Q. Now, again, in at least this summary, what, which 
line is the successful access versus the — 
A. It would be the first one, sir. 
Q . And what ' s the date of that search? 
A. 29 December 2009. 
Q. Thank you. 
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THE COURT: My understanding the 29 December 2009 
was successful and the other three were not? 

THE WITNESS: They may have been, therein lies the 
permutation of the log files. If you click on the link, it 
redirected it to somewhere else and I don't know where. 

THE COURT: Thank you. 

THE WITNESS : So it may have been . 

MR. MORROW: Your Honor, at this time the 
prosecution moves to admit prosecution exhibit 84 for 
identification into evidence . 

MR. TOOMAN: No objection, Your Honor. 

THE COURT : All right . Prosecution exhibit 84 is 

admitted. 

BY MR. MORROW: 

Q. Agent Shaver, I want to talk about the Intelink 
searches and the 14 February 2010 timeframe. First, based on 
your review of the searches in these logs, did the logs 
capture any searches for WikiLeaks on 14 February 2010? 

A. Yes, sir, I believe they did. 

Q. And generally again where did these searches lead on 
the SIPRNET? 
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A. To websites that have information pertaining to 
WikiLeaks . 

Q. I'm retrieving what's been marked as prosecution 
exhibit 85 for identification . 

Agent Shaver, I'm handing you prosecution exhibit 85 
for identification . 

A. Yes, sir. 

Q . Just take a moment and look at it , please . 
I'm retrieving prosecution exhibit 85 for 
identification with the witness. Permission to publish, Your 
Honor . 

THE COURT: Go ahead. 
BY MR. MORROW: 

Q. Agent Shaver, I won't go through all the lines in 
this document, but just describe for the court what this, 
first of all, again, what is the document? 

A. Again, this is a subset of the Intelink logs for 
February 14, 2010. 

Q. And where does this subset of logs begin, what's the 
first action? 

A. Again, it's another search for WikiLeaks, you can 
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see that from the top line under the Q equals WikiLeaks in 
this search, and the search ended up on an Army website. 

Q. Can you just point out the line, please? It might 
be easier if I just hand it back to you . 

A. Yes. I'm sorry, it's a little blurry on here. 

Q. Based on your review of the logs, were you able to 
identify any documents accessed by the user of those IP 
addresses in the logs? 

A. Yes, sir. 

Q. And what documents were you able to identify as 
being accessed? 

A. There is one called C C C here be dragons trip 
report . 

Q. And what line is that in that summary? 
A. 12. 

Q. And were there any other documents accessed as a 
result of this search on Intelink? 

A. There is an IIR as well, following a bunch of 
numbers, classified documents on WikiLeaks dot PDF. 

Q. And based on your review of the Interlink logs 
generally, have you ever seen this document accessed at a 
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previous time other than February 14? 
A. Yes, sir. 

Q. And what timeframe was that? 

A. I believe it was early December. 

Q. Agent Shaver, I just want to, what created this 
document? 

A. I did. 

Q. And how did you create it? 

A. Sir, it was just filtered on the date for February 

14. 

MR. MORROW: Your Honor, at this time the 
prosecution moves to admit prosecution exhibit 85 for 
identification into evidence . 

MR. TOOMAN: No objection. 

THE COURT: May I see it, please? 
BY MR. MORROW: 

Q. Agent Shaver, I want to shift gears for a moment. 
Other than searches made from the computers on Intelink, what 
other activity was significant that you observed in the 
Intelink logs? 

A. There were a number of hits, there were a number of 
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downloads using the WGet utility. 
Q. And what is WGet? 

A. Sir, that is a command line program executable 
designed to basically download files from web pages . 

Q. And when you say something's a command line program, 
what do you mean by that? 

A. It's command line, so there is not a graphical user 
interface . There ' s no need for a mouse . You have to type 
the commands in from the command prompt . So if you were to 
go to, you have a Windows computer, if you go to start, run, 
type CMD, and hit enter, a little black window would open and 
that would be command window. You could then type commands 
from there . 

Q. Now, is WGet — what is it, is it software? 
A. Yes, sir. 

Q. And you also said something about executable. 
What's an executable? 

A. It's just a program that runs. 

Q. And what's the difference between software and 
executable? 

A. Same thing, sir. 
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Q. It's just exactly basically? 
A. Yeah. 

Q. Now, based on your knowledge and experience, is WGet 
a standard program on Army computers? 

A. Not Windows computers, no, sir. 
Q. Why do you say that? 

A. Sir, part of our mission at CCIU was to find malware 
on a computer, so we had access to the Army Gold Master. And 
the Army Gold Master or AGM is how the Army distributes 
software to include Office and operating systems themselves 
across the Army network. So we had access to that. We would 
use that to, once you know what's supposed to be there, it's 
easier to figure out what ' s not supposed to be there . 

Q . All right . Let ' s talk about the presence of WGet in 
the logs . Do you recall the first example of WGet in the 
logs? 

A. I believe it was March 2010. 

Q. I am retrieving what's been marked as prosecution 
exhibit 83 for identification. I'm now showing them to 
defense counsel. 

I'm handing the witness what has been marked as 
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prosecution exhibit 83 for identification. Agent Shaver, 
could you take a moment and look through that, please? 
A. Yes, sir. 

Q. Do you recognize that document? 
A. Yes, sir, I do. 
Q. And what is it? 

A. Sir, this is, again, this is a filtered on WGet from 
March 7 from the Intelink logs . 

Q. And, again, when you say you filtered, so you 
created that document? 

A. Yes, sir, I did. 

Q. And when you created the document, did you a filter 
the information in any way from the original logs? 
A. No, sir. 

Q. So what was the filter you used to sort of create 
that summary? 

A. Basically WGet on March 7. 

Q. And what does that document show, just generally, 
and in a moment we'll go through it, but just generally what 
does it show? 

A. Sir, it shows a large number of files being 
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downloaded in an automated fashion . 

Q. And what is the date of the first download of a 
document using WGet? 

A. That would be March 7, 2010. 

Q. What time? 

A. 3:18. 

Q. And when is the last action of downloading using 
WGet in the logs? 

A. Last action is March 7, 2154. 
Q. 2154? 

A. I'm sorry. 7:06. I apologize. 

Q. So approximately between the first and last action, 
how much time elapsed? 

A. Just a few hours. 

THE COURT : Wait a minute . Let me stop you there . 
So the first download is 7 March of 2010 at 3:18? 

THE WITNESS: I apologize, ma'am, 7:06. 
THE COURT : You mean military time or are you using 
civilian time? 
BY MR. MORROW: 

Q. Agent Shaver, let's just go through it. 
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Permission to publish to the court, Your Honor. I'm 
just going to show the first page of this exhibit, Your 
Honor . 

Agent Shaver, approximately how much time, based on 
your review of these logs, how much time elapses between each 
use of WGet? 

A. Not a lot, sir. If you can see from lines seven 
through 13, they're all 7:46. Excuse me. 3:46. So not a 
lot of time between each one . 

Q. And let's, if you could just look at those lines 
specifically and just move to the right there, can you 
describe the action at the very right of the screen? What 
does the 200 mean and then describe going right, what does 
that mean? 

A. Yes, sir. Starting 200. 200 means success. The 
number following is the size of the file . And a little 
further to the right it shows what was used. In this case it 
was WGet and that was the version, 1.11.4. 

Q. Now, if you go to the left a little bit, I see a 
number of lines sort of recreated, document ID equals 144708, 
and then a number of document ID . What is the document ID? 
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A. The server this is being captured from is a 
Sharepoint server pertaining to Guantanamo Bay detainees . As 
such the documents are not stored by a common name, they're 
stored by a document ID. So to retrieve it, if you were to 
go to the website, you would click on the link that said 
common name, need a person's last name. But actually 
underneath it in the code it would say to retrieve a certain 
document ID . 

Q. So in this case what does the document ID represent? 
A. A file name. 

Q. Agent Shaver, approximately how many WGet actions 
did you observe in this log on 7 March? 
A. Over 700. 

MR. MORROW: Your Honor, at this time the 
prosecution moves to admit prosecution exhibit 83 for 
identification into evidence as prosecution exhibit 83 . 

MR. TOOMAN: No objection, Your Honor. 

THE COURT: Can I see it, please? 

Thank you . Prosecution exhibit 83 for 
identification is admitted. 
BY MR. MORROW: 
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Q. Agent Shaver, you said that those document IDs 
resolved or went back to the detainee assessments located on 
the SIPRNET, correct? 

A. Correct. 

Q. Now, in any time in your review of the Intelink 
logs, did you notice any other activity or accessing of 
information on detainee records on Intelink? 

A. Yes, sir. 

Q. And what time was that? 
A. 5 March 2010. 

Q. I'm retrieving what's been marked as prosecution 
exhibit 82 for identification . 

I'm handing the witness what's been marked as 
prosecution exhibit 82 for identification. 

Do you recognize that document, Agent Shaver? 
A. Yes, sir, I do. 
Q. And what is that? 

A. Sir, this is a document, a subset of the Intelink 
for March 5, 2010. 

MR. MORROW: Permission to publish to the court, 
Your Honor . 
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THE COURT: Proceed. 
BY MR. MORROW: 

Q. Agent Shaver, I'm just going to show you the first 
page of the exhibit. And if you would, Agent Shaver, using 
this document, just describe the activity that you're seeing 
in the logs . 

A. The activity, somebody is on a computer assigned IP 
dot 22 is downloading files. Again, you see the file 
document again and you see their link to the website is there 
and you see some 200s and you see some 000s. There's an 
issue for that download didn't quite work right. And there's 
time and dates associated with those downloads . 

Q. Now, in terms of what the user is doing or what 
you ' re observing in this activity on the Intelink versus the 
7 March activity, what's the difference between those two 
accessing — the accessing of the detainee assessment on 
those two dates? 

A. This appears to be a lot of right clicking, save as. 

Q. And why do you say that? 

A. Because it's the time. It's not as fast and there's 
some errors , so it looks , it appears to be somebody ' s 
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manually downloading these files . 

Q. Did you observe WGet on 5 March? 
A. No, sir. 

Q. And how do you know that, again, these are detainee 
assessments, where are the logs that show those are the files 
being accessed? 

A. It actually says that, action line, it says the 
website week JDIV Gitmo detainee assessments . 

Q. Thank you. Now, again — 

THE COURT: Before you move that, I've got a 
question. You have the 200s where you say were a success, 
after some of the 200s then you have 000. What does that 
mean? 

THE WITNESS: There's a problem. 
THE COURT: Thank you. 
BY MR. MORROW: 

Q. Agent Shaver, how was this, again, and you may have 
answered this, how was this summary created? 

A. I filtered based off the date and the action. 
MR. MORROW: Your Honor, at this time the 
prosecution moves to admit prosecution exhibit 82 for 
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identification into evidence . 

MR. TOOMAN: No objection, Your Honor. 

THE COURT: Prosecution exhibit 82 is admitted. 

MR. MORROW: Thank you, Agent Shaver. Government 
has no further questions at this time . 

MR. TOOMAN: Your Honor, the defense would request a 
ten minute comfort break . 

THE COURT: Any objection? 

MR. FEIN: No, ma'am. 

THE COURT: All right. Agent Shaver, please don't 
discuss your testimony or knowledge of the case with anyone 
other than counsel or the accused while we are on the recess . 
Court is in recess until five minutes to eleven . 
(BRIEF RECESS . ) 

THE COURT: Court is called to order. Let the 
record reflect all parties present when the court . 
Captain Tooman, cross examination. 
MR. TOOMAN: Thank you, Your Honor. 

CROSS EXAMINATION 

BY MR. TOOMAN: 

Q. Good morning, Agent Shaver. 
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A. Good morning, sir. 

Q. Agent Shaver, I'd like to start out by on direct you 
talked a little bit about some of the computers that you had 
associated with my client. 

A. Yes, sir. 

Q. You had associated the dot 22 machine? 
A. Yes, sir. 

Q. That was one. And the other was the dot 40 machine? 
A. Yes, sir. 

Q. I want to focus on the dot 22 machine for just a 
moment. Now, on that machine, you didn't have any activity 
that you would associate with my client before 2 March in the 
allocated space, is that correct? 

A . Okay . 

THE COURT: Whoa, whoa, whoa. 

Q. On the dot 22 machine there was a user account, 
Bradley dot Manning, correct? 

A . Right . 

Q . And that user account didn ' t have anything in the 
unallocated space before 2 March, is that correct? 

MR. MORROW: Objection. Outside the scope of 
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direct . 

THE COURT: Overruled. 

THE WITNESS: Sir, your terminology I believe is 
incorrect . 
BY MR. TOOMAN: 
Q . Okay . 

A. You're asking — may I ask? You're asking me are 
there any files pertaining to the Bradley dot Manning user 
account prior to 2 March? 

Q. 2 March. 

A. That are allocated. 

Q. That are unallocated. Let me rephrase the question. 
In the dot 22 computer, there's a user account, 
Bradley Manning? 
A. Correct. 

Q. That user account didn't exist before 2 March, 
correct? 

A. Correct. 

Q. And that user account didn't exist before 2 March 
because that computer had been re-imaged? 
A. Correct. 
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Q . And that computer was re-imaged by the G6 or whoever 
was in charge of those computers? 
A. That's correct. 

Q . Okay . And you ' ve been to Iraq? 
A. Yes, sir. 

Q. And you understand that there are a lot of reasons 
why a computer would be re-imaged in Iraq? 
A. Correct. 

Q. It ' s a difficult environment for the machine? 
A. Yes, sir. 

Q. It's hot, that puts stress on the machine? It's 
dusty, sandy? 

A. Yes, sir. 

Q. And those things could cause problems for the 
machine? 

A. Correct. 

Q. And one way that an administrator might deal with 
those problems is to re-image it? 
A. Correct. 

Q. That's what happened with the dot 22 machine? 
A. Correct. 
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Q. And that wasn't anything my client did, that was 
whoever was in charge of those machines? 
A. Yes, sir. 

Q. Now, you talked about, on direct you talked about 
the Intelink logs and the searches, you talked about how you 
created the Excel document where you were able to pull out 
all of the actual searches? 

A. Yes, sir. 

Q. And to separate the wheat from the chaff, here are 
the searches, correct? 
A . Uh-huh . 

Q. And you talked about a number of searches for 
WikiLeaks? 

A. Yes, sir. 

Q. You talked about searches for ACIC documents? 
A. Just WikiLeaks. 

Q. Well, you talked about searches or activity on the 
Intelink logs related to detainee assessments? 
A. Correct. 

Q. There were in total from May — I'm sorry. From 
November of 2009 to May of 2010 there were probably close to 
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800 searches? 

A . Sounds right . 

Q. And not all of those had to do with WikiLeaks? 
A. Correct. 

Q. A lot of those searches had to do with a lot of 
other things? 

A. Yes, sir. 

Q. And with those Intelink logs, all you can really say 
is that the dot 22 machine or the dot 40 machine did a search 
for whatever term? 

A. Correct. 

Q . You can ' t say that that was PFC Manning who did the 
search? 

A. Correct. 

Q . You can ' t say it was Captain Tooman who did the 
search? 

A. Correct. 

Q. You could say if it was you that did the search, but 
you don ' t know who did the search? 
A. Correct. 

Q. Okay. There were a lot of other searches done? 
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A. Yes, sir. 

Q. There were searches for gender identity disorder? 
A. Yes, sir. 

Q. There were searches for APFT scores? 
A. Yes, sir. 

Q. There were searches for Green to Gold? 
A. Yes, sir. 

Q. Now, I want to focus on some more of those searches. 
There were also a number of searches related to CENTCOM, 
correct? 

A. Correct. 

Q. Now, CENTCOM is the command that oversees Iraq, 
correct? 

A. Yes, sir. 

Q. Iraq falls underneath CENTCOM. So there would be a 
lot of reasons why a computer user might search for CENTCOM? 
A. Sure. 

Q. I want to talk about some of those CENTCOM searches 
a little more specifically. There was a search for CENTCOM 
on or involving CENTCOM on 30 November 2009, is that correct? 

A . Sounds right . 
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Q . There was another search on 9 December for CENTCOM 
that was done by the 40 machine? 
A . Okay . 

Q. Is that — do you have you — 

A. I don't have the notes in front of me, sir. 

THE COURT: Let me ask you to do something, please. 
If you know something to be a fact and you're agreeing with 
the questioner, say that. If you don't know or you're not 
sure because you don't have something in front of you, don't 
agree . 

THE WITNESS: Okay. 
BY MR. TOOMAN: 

Q. Is there anything that would allow you to answer 
those questions? 

A. Yes, sir. One of the exhibits from earlier. 

MR. TOOMAN: Okay. Your Honor, I'd like to retrieve 
prosecution exhibit 81 and ask Agent Shaver to move to the 
witness stand because I believe that's classified. 
THE COURT: All right. Certainly. 

MR. TOOMAN: Handing the witness what's been marked 
as prosecution exhibit 81. 
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BY MR. TOOMAN: 

Q. Agent Shaver, we'll start over. We'll start from 
the top with searches that implicate CENTCOM. On the 30th of 
November we have a search by the dot 40 machine related to 
CENTCOM, is that correct? 

A. (INAUDIBLE) . 

Q . No , I do not . 

A. (INAUDIBLE) . 

THE COURT : Take your time . 
THE WITNESS: Yes, sir. 

Q. There's also a search on 9 December by the dot 40 
machine and that ' s a search for S J A plus CENTCOM? 

A. Yes, sir. 

Q. And on the 15th of November — I'm sorry — the 15th 
of December, again, the dot 40 machine, we have a search just 
for CENTCOM? 

THE COURT: Did you say the 14th of December? 
MR. TOOMAN: 15th, Your Honor. 
THE WITNESS: Correct. Yes, sir. 
BY MR. TOOMAN: 

Q. The very next day, again, the dot 40 machine 
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searched for CENTCOM plus S J A? 
A. Yes, sir. 

Q. Then on the 31st of December the dot 40 machine 
searched for CENTCOM plus portal? 
A. Correct. 

Q. 2 January 2010 we see the 40 machine searching for 
CENTCOM plus non-rel, N O N R E L? 
A. Yes, sir. 

Q. On the 4th the dot 40 machine searches for CENTCOM? 
A. Yes, sir. 

Q. Okay. Then our next search is the 19th of February, 
still the dot 40 machine and it's just for CENTCOM? 



A. 


What date again was that, sir? 


Q. 


19 February. 


A. 


Yes, sir. 


Q. 


And then on the 28th? 


A. 


Yes, sir. 


Q. 


We have one by the dot 40 machine as well? 


A. 


Yes, sir. 


Q. 


And that ' s a search for CENTCOM? 


A. 


On 28 November, yes, sir. 
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Q. Then on 12 March, we see our first search from the 
dot 22 machine, and that's for a long string, but you would 
agree with me that that is basically searching for don't ask, 
don't tell? 

A. Yes, sir. 

Q. Then on the 17th of March, the 22 machine searches 
for, again, another long string E-Books plus site, percentage 
three? 

A. Yes, sir, I see that. 

Q. And then on the 22nd of March we see a search for 
Farah plus CENTCOM, and that was the 22 machine? 
A. Yes, sir. 

Q. Let me retrieve that exhibit from you. Handing 
prosecution exhibit 81 back to the court reporter. 

Now, Agent Shaver, those were the only searches for 
CENTCOM on the Intelink logs that specifically talked about 
CENTCOM, correct? 

A. Looks that way, yes, sir. 

Q. And there was only one that specifically searched 
for Farah? 

A. Correct. 
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Q. And that was on 22 March? 
A. Yes. 

Q. Agent Shaver, I want to talk a little bit more about 
Farah. You talked on direct about there are ways that we can 
tell, you can tell a search was done, but we can't really 
tell what happened after that, is that correct? 

A . That ' s correct . 

Q. There's some indication that maybe a file was 
viewed, but we have to look other places to find out what 
happened as a result of that search, correct? 

A. Correct. 

Q. And one of those places would be Centaur logs, is 
that correct? 
A. Yes. 

Q. Could you explain to the court what a Centaur log 

is? 

A. Yes, sir. 

MR. MORROW: Your Honor, objection. There's been no 
evidence to suggest that he examined something called a 
Centaur log. Lack of foundation here. It's outside the 
scope of direct examination. 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Morning Session 



70 



THE COURT: How is it within the scope? 

MR. TOOMAN: It's within the scope of direct 
examination, Your Honor, because the government talked about 
searches and then different ways that we can see what 
happened with the searches . 

Additionally, the government has already requested 
judicial notice of the Centaur logs so that ' s already 
something the court has considered. This witness has 
reviewed the Centaur logs, he will talk about that. 

THE COURT: I'm going to overrule at this point just 
telling me what a Centaur log is . Do you dispute the fact 
that he does know what it is? 

MR. MORROW: No, Your Honor. I do dispute the fact 
that we asked you to take judicial notice of the Centaur logs 
though . 

THE COURT : Do you have your consolidated judicial 
notice list has that been put on as an appellate exhibit yet? 

MR. TOOMAN: Your Honor, it's in the 18 July 2012 
ruling, appellate exhibit 216. 

THE COURT: May I see appellate exhibit 216, please? 

216 is the one you're relying on, right? 
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MR. TOOMAN: Yes, ma'am. 

THE COURT: All right. Government, I'm looking at 
appellate exhibit 216. Number four talks about Centaur logs. 

MR. FEIN: Yes, ma'am. So this was a government 
motion to preadmit evidence, not judicial notice. The 
government did move to preadmit and the court ruled that 
based off the government ' s showing of relevance that this 
evidence would otherwise be admissible. The government does 
intend to admit this evidence, in fact, with the predicate 
witnesses prior to Special Agent Shaver and then Special 
Agent Shaver's testimony. I think my co-counsel's objection 
was just based off it's outside the scope of this direct 
because there's no context, no foundation, prior facts not 
going to understand that the background is Centaur . 

THE COURT : So you ' re going to be recalling this 
witness to talk about Centaur logs? 

MR. FEIN: Absolutely, Your Honor. 

THE COURT: Why are we getting into it now? 

MR. TOOMAN: Your Honor, the government believes the 
government opened the door to Agent Shaver ' s investigation 
and we ' d like to talk to him about it . 
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THE COURT: The government didn't mention anything 
about Centaur logs, so are you waiving your relevance 
objection for these logs to come in? 

MR. TOOMAN: Yes, Your Honor. We would, yes, Your 

Honor . 

THE COURT : I think it ' s beyond the scope of direct . 
The government just didn't talk about it, so I'm going to 
sustain the objection. 

MR. TOOMAN: Okay. 
BY MR. TOOMAN: 

Q. Agent Shaver, I'd like to talk to you, you spoke on 
direct about the ACIC report? 
A. Yes, sir. 

Q. And you saw a number of searches for that, one was 
on 29 December, there was one on 14 February? 
A. Correct. 

Q. And then there were two on 1 March, correct? 

Your testimony on direct was only one of those 
searches was successful and that only one time did something 
get pulled up? 

A. No, sir. 
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Q . Okay . 

A. I can show, number one, the first hit was a success. 
The other ones are redirected. I don't know if they're 
successful. They're redirected to another log file, another 
server. I cannot tell you if it was successful or it was 
not . 

Q. Okay. So only that first search could you say for 
sure this was successful? 
A. Correct. 

Q. Now, based on your review of the intel logs, you 
couldn't say if that document was downloaded, correct? 

A. It was viewed, so technically it was downloaded 
because you see the bytes transferred. It was viewed upon 
the computer itself. 

Q. Okay. You couldn't tell if there was a right click, 
save as? 

A. No, sir. 

Q. You couldn't tell if it was printed? 
A. No, sir. 

Q. You also couldn't tell how long that screen was up, 
correct? 
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A. Correct. 

Q. So it could have been up for a second, it could have 
been up for five minutes? 
A. Correct. 

Q. The same would be true for the C3 report that you 
talked about on direct as well, correct? 
A. Correct. 

Q. Can't tell how long it was viewed, is that correct? 
A. Correct. 

Q. You can't tell if it was saved? 
A. Correct. 

Q. You also couldn't tell if it was printed? 
A . That ' s correct . 

Q. And I believe you said that the 22 machine is the 
one that did those things. Either way you can't associate 
the viewing of those documents with any particular person, 
correct? 

A. Correct. 

Q . Just with the machine . 
A. Correct. 

Q. I'd like to speak with you, you talked about WGet on 
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direct . I'd like to talk to you now about that . 

You would agree with me that WGet is a program 
that's used to download web pages? 

A. Yes, sir. 

Q. Archive pages? 

A. Sure. 

Q. Download things? 
A. Sure. 

Q. You wouldn't say that this is a program that's 
synonymous with hacking, would you? 
A. Correct. It's just a tool. 

Q . Just a normal program that ' s used every day by a lot 
of different people? 
A. Yes, sir. 

Q. Now, you talked about detainee assessment briefs? 
A. Yes, sir. 

Q . And you talked about the Intelink ' s logs show that 
on 5 March there were attempts from your perspective of 
clicking, opening and saving, that's what the Intelink log 
suggested? 

A. Correct. 
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Q. And then on 7 March you had, again, activity with 
the detainee assessment briefs, but here it looked like WGet 
was used to download those files, correct? 

A. Yes, sir. 

Q. You would agree with me that basically what WGet was 
doing was clicking, opening and saving, it was just doing it 
quickly? 

A. In automated fashion. 

Q. Faster than a human could do it? 

A. Yes. 

Q. But still the same action, essentially the click, 
open, save? 

A. Correct. 

Q. Now, as part of your investigation, you actually 
used WGet, didn't you? 

A. Yes, sir, I did. 

Q. And what you did with WGet was you tried to 
download, you wanted to see if you could download the 
detainee assessment briefs? 

A. Correct. 

Q. And you were able to do that? 
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A. Correct. 

Q. And what you did was you wrote a script and you ran 
the script and then you actually downloaded the detainee 
assessment briefs? 

A. Yes, sir. 

Q. And that only took you a few minutes to do? 
A. Yes, sir. Did not take very long. 

Q. Didn't take very long to download over 700 detainee 
assessment briefs? 
A. Correct. 

Q. And while that was happening, you were able to do 
other things on your machine? 
A. Yes, sir. 

Q. So one could run WGet and it would run in the 
background and you could do other things? 

A. Yes, sir. You would take a performance hit, but, 

yes . 

Q. When WGet ' s running, you don't have to actually be 
there, do you? You don't have to be sitting at the computer 
actively doing anything, correct? 

A. No, sir. 
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Q. And, again, it basically just automates the click, 
open, save? 

A. Correct. 

MR. TOOMAN: No further questions, Your Honor. 

THE COURT: All right. Redirect. 

MR. MORROW: No, Your Honor. 

THE COURT : All right . I have a couple . 

We talked earlier about the 200 means it's 
successful and the 000 means there's a problem. 

You just said in response to Captain Tooman's 
questions that when a search is redirected to somewhere else, 
you don't know what happens to it. Can you just tell me, 
give me an example of a search, you would search for 
something and it would go somewhere else and what happens? 

THE WITNESS: Yes, ma'am. So are you familiar with 

Google? 

THE COURT: Yes. 

THE WITNESS : So you go to Google and you put in 
Wolf Blitzer, it takes you to the CNN web page and now you're 
on the CNN web page . Google is no longer tracking what 
you're doing on CNN, but the redirect took you there. And in 
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this instance that R B document was directed to another site, 
and once it ' s on the other site it ' s no longer part of 
Intelink. Does that make sense? 

THE COURT: Yes. Thank you. 

You testified earlier that to assess whether a 
program is authorized on a Army computer, I just want to make 
sure I got your testimony correctly. What did you use the 
Army Gold Master's program to determine? 

THE WITNESS : We used that — excuse me . When I 
worked at CCIU, we would use that to determine what are the 
authorized programs, those are the Army programs that are 
commonly available to the users on the Army network . WGet 
was never part of those . 

THE COURT: If you're not the right witness to ask 
this question to, tell me. 

Are you familiar with, does that program say that if 
it's not on here, you can't use it or you can't put it on the 
computer? 

THE WITNESS: No, ma'am. That would be considered a 
certificate of networthiness, also called a CON. That would 
be the final authority on what ' s authorized and what ' s 
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unauthorized . 

THE COURT: I'm beginning to stray into areas that 
the government mentioned on their direct, but were not fully 
explored. Any objection to my continuing to question this 
witness about them? 

MR. MORROW: No, Your Honor. 

MR. TOOMAN: No, ma'am. 

THE COURT: Tell me what that was called again, a 
certificate of — 

THE WITNESS: Networthiness . Commonly referred to 
as a CON, CON. 

THE COURT: Assume I'm a computer user, how do I go 
about obtaining a CON? 

THE WITNESS: It is a process through one of the 
Army SERS, the Army regional at Fort Huachuca, Arizona. You 
would put in a request to use a piece of software on the Army 
network . They would evaluate it to make sure it ' s not — it 
meets certain criteria, whether you have to pay for it, what 
it does on the network, does it create a vulnerability on the 
network . And then they would eventually get back to you and 
say yes or no. 
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THE COURT : The Army sometimes structures automation 
such that the user does not have administrative rights to 
insert, to add things in the computers that you examined that 
you testified about today. Could the user, did the user have 
administrative rights to add whatever they wanted to? 

THE WITNESS: No, ma'am, they do not. However, WGet 
is the, the executable itself does not need administrative 
privileges to run, so you can use, anybody can download it, 
anybody can run it . 

THE COURT : Are you aware of any specific 
authorization of or prohibition of program WGet? 

THE WITNESS: When I looked at the certificate of 
networthiness, WGet was not on that list. 

THE COURT: So that certificate is one certificate 

of — 

THE WITNESS: The CON itself, the one I saw the 
Excel spreadsheet of what was authorized and what was not 
authorized for the Army network . I was looking at it for 
another matter . I obtained it for another case . But WGet 
was not present on that CON. 

THE COURT: And that CON was applicable for what, a 
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particular unit or geographic area? 

THE WITNESS: As far as I know, the Army. 
THE COURT : Any follow-up questions from either side 
based on my questions? 

MR. MORROW: One moment, Your Honor. 

Just a couple of questions, Your Honor. 
REDIRECT EXAMINATION 

BY MR. MORROW: 

Q. Agent Shaver, when someone searches for something on 
the SIPRNET, and we've probably have gone over this, but what 
does the resulting, at least if you're on the Intelink 
server, what does the resulting activity show in the logs? 

A. It would show any hits pertinent to the search you 
put in . 

Q. Now, when you say hits, what do you mean by that? 

A. Again, it's basically Google, so if you put a 
keyword in, again, let's go back to Wolf Blitzer, everything 
that pops up would be pertinent to the key term Wolf Blitzer. 

Q. So you would have a number of results? 

A. Yes, sir. 

Q. And if you clicked on one of those results, what 
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would happen? 

A. It would take you to the website or the document 
pertaining to that information . 

Q. Now, if it took you to the website or document 
pertaining to that information, would that activity always be 
captured by the Intelink logs? 

A. No, sir. 

Q. And why is that? 

A. Depends, sir. Depends where the document is 
located. Again, if it's not on — if it's on another website 
it would be captured, that information would be captured on 
that other website . 

Q. Agent Shaver, when you were talking about the 
certificate of networthiness, what type of computer were you 
referring to? 

A. Windows computer. 

Q. But SIPRNET, NIPRNET, what were you talking about? 
A. Either or. 

Q. Have you seen the certificate of networthiness for a 
DCGS Alpha computer? 

A. No, sir, I have not. 
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Q. And where does WGet come from, where does someone 
acquire or obtain the WGet program? 

A. You would find it, you would search for it on the 
Internet and find it on the Internet . 

Q. So it ' s available to anyone on the Internet? 

A . That ' s correct . 

Q. And if you were to put a program or an executable 
like WGet on a computer, and you wanted it to be available to 
all the users of that computer, anyone who logged in, where 
would you put it on the computer? 

A. Program files. 

Q. And why would you put it in the program files if you 
wanted it to be available to all the users? 

A. It ' s a permission issue. Everybody can have access 
to it . They can all execute that document . If for example 
you put it in a user profile, one user profile just due to 
permissions cannot see the contents of another user for 
security reasons . 

Q. So a computer may have any number of user profiles 
because, at least in the government, people share computers, 
right? 
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MR. MORROW: Thank you. 

MR. TOOMAN: Just a couple, Your Honor. 
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RECROSS EXAMINATION 

BY MR. TOOMAN: 

Q . Agent Shaver . 
A. Sir. 

Q. You spoke about the Army Gold Master's program. The 
Army Gold Master program, they don't review every program or 
software executable file that exists, correct? 

A. The Army Gold Master is just a disk of software they 
provide, the Army provides to the users. 

Q. Well, the Army doesn't review every single file or 
piece of software type of executable file to determine 
whether or not there's a certificate of networthiness for it, 
correct? Did it look at everything? 

A. Everything in the world? 

Q. Everything in the world. 

A. No. 

Q. So the fact that there isn't a certificate of 
networthiness doesn't necessarily mean that it would be a 
problem to have it on the Army system? 

A. Technically as I understand it, technically you 
would need an exception to policy, the Army, you would just 
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have an exception of policy to run a specific program on a 
specific network for a specific reason . There would be a 
signed document for that . 

Q. And I guess a certificate of networthiness or the 
lack of a certificate of networthiness doesn't mean if the 
program were reviewed it wouldn't get one? 

A. Correct. 

Q. Now, you talked about WGet . WGet is an executable 
file, is that correct? 
A . That ' s correct . 

Q. And you double click on it, it opens, and it runs, 
correct? 

A. Again, it's a command line, so if you double click 
on it, a black window would open and close very quickly and 
not do anything. You have to do it from the command line. 

Q . You would agree with me that it ' s an executable 
file? 

A. Yes, sir. 

Q. And Army systems can be configured to prevent the 
running of executable files? 
A. Yes. 
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Q. Now, you talked about where an individual can put a 
file if they add something to their machine . They could put 
it in their own personal user file or it could get added to 
program files, correct? 

A. Correct. 

Q. If you wanted to add something to the program files, 
I would need administrative rights for that, wouldn't I? 
A . That ' s correct . 

MR. TOOMAN: Nothing further, Your Honor. Thank 

you . 

THE COURT: Any redirect from the government? 
MR. MORROW: No, Your Honor. 

THE COURT: Let me just make sure I'm clear on this. 
Based on the last question from Captain Tooman, am I 
understanding this WGet program was in the user files as 
opposed to the programs file on the computers you found? 

THE WITNESS: Correct. 

THE COURT: If the user attempted to put WGet on the 
programs file, what would have happened? 

THE WITNESS: They would ask for permission. They 
would ask for administrator privilege or account to do this . 
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THE COURT: Well, did the user in this case have an 
administrative privilege account? 
THE WITNESS: No. 

THE COURT: If the user tried to put that program on 
a program drive without going through that process that you 
just described, would the computer let him? 

THE WITNESS: No. 

THE COURT : Any further questions based on my — 
MR. MORROW: No, Your Honor. 
MR. TOOMAN: No, ma'am. 

THE COURT: All right. Temporary excusal? 
MR. MORROW: Temporary, Your Honor. 

THE COURT: Special Agent Shaver, once again, you're 
temporarily excused. Please don't discuss your testimony 
with anyone but the accused or the counsel while the trial is 
going on. 

MR. WHYTE: Ma'am, the United States calls Mr. Chad 

Madaras . 
Whereupon : 

CHAD MADARAS, 

called as a witness, having been first duly sworn according 
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to law, testified as follows : 

DIRECT EXAMINATION 

BY MR. WHYTE: 

Q. You are Chad Madaras? 
A. Yes, sir. 

Q. Mr. Madaras, what is your current military status? 

A. I'm inactive reserves, sir. 

Q. When did you leave the military? 

A. January 16, 2013. 

Q. And how long did you serve for? 

A. Approximately six years, sir. 

Q. What was your MOS during that time? 

A. I was a 35 Fox intel analyst. 

Q. For the entire six years? 

A. Yes, sir. 

Q. And where were you stationed? 
A. At Fort Drum. 

Q. Do you remember when you arrived at Fort Drum? 
A. November 2007. 

Q. When you arrived what unit were you assigned to? 
A. Second Brigade, sir. 
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Q. Tenth Mountain Division? 
A. Yes, sir. 

Q. And how did you know PFC Manning at Fort Drum? 
A. I didn't really know him that well at Fort Drum, I 
just met him once in the smoking area outside our barracks . 
Q. Did you deploy out of Fort Drum? 
A. Yes, sir. 

Q. And what pre-deployment? 

A. I had two JRTC rotations and a DCGS course. 

Q. The JRTC, when were those? 

A. October of 2008 and July of 2009, sir. 

Q. Did PFC Manning attend both of those with you? 

A. From the best of my recollection, yes, sir. 

Q. And you mentioned a DCGS training, can you explain 
what that entailed? 

A. We had a DCGS course that covered all the 
fundamentals of a DCGS machine multi-function station and how 
to use all the components. 

Q. Did PFC Manning attend that with you? 

A. Yes, he did. 

Q. At this training what were you taught about who was 
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responsible for handling the DCGS machine in theater? 

A. We were told we have a DCGS FSR downrange with us. 

Q. And what is an FSR? 

A. Field support representative, sir. 

Q. How long is this training on the DCGS machine? 

A. It was a week long, sir. 

Q. So where did you deploy from? 

A. Second Brigade, Fort Drum. 

Q. Where did you deploy to? 

A. FOB Hammer, sir. 

Q. Did PFC Manning deploy to FOB Hammer as well? 

A. Yes, sir. 

Q. Do you remember when you arrived at FOB Hammer? 

A. Sometime around October 15, 2009. 

Q. Do your remember when PFC Manning arrived? 

A. It would be about a week or two later, sir. 

Q. Where did you work at FOB Hammer? 

A. In the brigade SCIF . 

Q. Where did PFC Manning work? 

A. In the brigade SCIF also. 

Q. And what section were you assigned to? 
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A 

Q 
A 

Q 

A 

Q 

A 

Q 

A 

Q 

A 

Q 

A 

Q 



We were fusion cell, part of the Shia team. 

What do you mean by we? 

Me and PFC Manning. 

So you both were Shia — 

Yes, sir. 

— intel analysts working in the SCIF? 
Yes, sir. 

What shift did you work on? 
I worked day shift . 

And what shift did Manning work on? 
The night shift . 

What type of computer did you use at FOB Hammer? 
We used DCGS-A laptop, Dell. 

And how many computers did you have at your work 



station in the SCIF? 



A 

Q 
A 

Q 
A 

Q 



Just one, sir. 

And who did you share that work station with? 
I shared it with PFC Manning. 

What network was this DCGS machine hooked up to? 
It was on the SIPRNET work, sir. 

And who did you share this DCGS SIPRNET computer? 
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A. With PFC Manning. 

Q. For how long did you share this? 
A. For six months. 

Q. When in the deployment did you share this? 

A. When we first took over all the way up until around 
the March timeframe, sir. 

Q. So let's just talk about when you were actually in 
the SCIF, just to give the court a time line. You said you 
arrived 15 October 2009? 

A. Yes, sir. 

Q. When was the first time that you left the SCIF? 

A. Just before Christmas of 2009. 

Q. And where did you go? 

A. I went to (INAUDIBLE) . 

Q. And how long was this? 

A. It was about a week long. 

Q. And then you returned back to FOB Hammer working in 
the SCIF? 

A. Yes, sir. 

Q. When did you next leave FOB Hammer? 

A. I left around January 27, 28 when I went on R and R. 
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Q. And how long were you gone for? 
A. Returned around February 15. 

Q. What about the next time you left FOB Hammer? 
A. I left in March for the parliamentary elections of 
Iraq. 

Q. And how long were you gone for? 
A. For a week again, sir. 

Q. So when did you stop working in the SCIF? 

A. Around the end of May, beginning of June, sir. 

Q. Are you familiar with Intelink? 

A. Yes, sir. 

Q. What is Intelink? 

A. It's a separate search engine like Google. 
Q. Did you use Intelink as a 35 Fox? 
A. Yes, sir. 

Q. What are some of the benefits of using Intelink as a 
35 Fox? 

A. If you didn't have a lot of information on somebody 
or a name came up in a report that you weren't really sure, 
you can just throw it in there to see if you got any hits 
right off the bat . 
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Q. Let the record reflect that I'm retrieving 
prosecution exhibit 81 from the court reporter . 

MR. COOMBS: Your Honor, to the extent that the 
government is going to use 81 to ask this witness did he do 
any of those searches, we would stipulate that he did not do 
any of those searches . 

THE COURT: All right. Is that where you were going 
with this? 

MR. WHYTE: Yes, Your Honor. But it may be helpful 
to hear what Madaras did not search. 

MR. FEIN: May we have a moment, Your Honor? 
THE COURT: Why? Okay. 
(DISCUSSION OFF THE RECORD.) 

THE COURT: Why would it be beneficial? If the 
defense is stipulating that the witness did not do any of 
those searches, why would it be beneficial for me to listen 
to the particular searches that he did not do? 

MR. WHYTE: Yes, ma'am. Never mind, we will not 

ask . 

THE COURT: Proceed. 
BY MR. WHYTE: 
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Q. Mr. Madaras, did you use a CIDNE Iraq to pull 
intelligence? 

A. Yes, sir. 

Q. Are you aware if there's a CIDNE Afghanistan? 
A. There is, sir. 

Q. Did you use CIDNE Afghanistan? 
A. No, sir. 
Q. Why not? 

A. It did not really pertain to anything we were doing 
in our area. 

Q. Did you use Net-Centric diplomacy to search for any 
intelligence? 

A. No, sir. 

Q. Did you pull any Department of State cables? 
A. No, sir. 

Q. What region of the world were you focused on when 
you were at FOB Hammer? 
A. Eastern Baghdad. 

Q. Did you ever search for intelligence on Iceland? 

A. No, sir. 

Q. South America? 
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A. 


No, sir. 


Q. 


Europe? 


A. 


No, sir. 


Q. 


Africa? 


A. 


No, sir. 


Q. 


East Asia? 


A. 


No. 


Q. 


And why not? 


A. 


Did not pertain to anything we were doing in eastern 



Baghdad . 

Q. Are you familiar with WGet? 
A. No, sir. 

Q. Let's talk about some of the issues that you had 
with your computer when you were at FOB Hammer . During your 
deployment explain what type of problems you had with the 
computer at FOB Hammer? 

A. The computer used to crash on a regular basis or 
operate really, really slowly to the point where it was 
difficult to get any work done. 

Q. And how often did you have these computer problems? 

A. About twice a week. 
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Q. So can you please explain to the court during those 
two times per week you showed up for a shift change, what 
happened? 

A. When I'd log on to the computer, it would run really 
slow, wouldn't really load up anything that I was trying to 
use to complete my work, and then sometimes it would just 
completely crash. 

Q. And when did you notice these computer problems? 

A. It was right off the bat at the beginning of my 
shift . 

Q. So what would you do when you had these computer 
problems? 

A. I'd get Alan Millman and get him to work on the 
machine . 

Q . And who was Mr . Millman? 
A. He was our DCGS FSR. 

Q. What would Mr. Millman do to fix the machines? 
A. He'd usually have to re-image the system. 
Q. After Mr. Millman worked on the computer, can you 
describe how the computer operated? 

A. It would operate like brand new again. 
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How did it operate for the remainder of your shift? 



A. It would operate well. 
Q. What about the following day? 
A. It would slowly start to deteriorate. 
Q. How many times did Mr. Millman re-image your 
computer? 

A. Probably about five times, sir. 

Q. And what was your understanding of why you were 
having these computer problems? 

MR. COOMBS: Objection, Your Honor. Calls for 

hearsay . 

THE COURT: Did this witness get his understanding 
from somebody else? 

MR. WHYTE: Yes, Your Honor. 

THE COURT : What ' s the hearsay exception? 

MR. WHYTE: It's actually not for the truth of the 
matter asserted. It's effect on the listener, what Mr. 
Madaras did in response to that . 

THE COURT: And the question was again? 

MR. WHYTE: The question was what was your 
understanding as to why you were having these computer 
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problems . 

THE COURT: Why don't you just ask him after you 
understood why you were having the computer problems what did 
you do next? 
BY MR. WHYTE: 

Q. After you knew why you were having these computer 
problems, what did you do next? 

A. I asked PFC Manning to try to remove some of the 
unneeded documents off his desktop, and I also did so myself. 

Q. Did you look at PFC Manning's desktop? 

A. I couldn't see the desktop, but I could see the file 
size . 

Q. And how would you describe the file size? 
A. It was very large. 

Q. What did you store on your desktop? 

A. I would store any project that I was currently 
working on, so Power Points and any reports that I needed to 
work on the project . 

Q. So what did you do to reduce your desktop size? 

A. Anything that was from previous project I was 
working on I went ahead and deleted them, got rid of them. 
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Q . So after you told PFC Manning to limit the amount on 
his desktop, did you have problems after that? 
A. Yes, I still did. 

Q. How did your computer problems affect your ability 
to work at FOB Hammer? 

A. It would take about two hours of my work schedule 
for Alan to figure out what was wrong with it, and if he had 
to re-image it it would take approximately two hours . 

Q. And how often did other 35 Foxes have problems with 
their computers? 

A. Everybody had one about once throughout their entire 
deployment . 

Q. Do you remember when you stopped sharing a computer 
with PFC Manning? 

A. It was when I returned from the elections in March 
of 2010. 

MR. WHYTE: No further questions, Your Honor. 
THE COURT: Proceed. 

CROSS EXAMINATION 

BY MR. COOMBS: 

Q. Mr. Madaras, you first met PFC Manning in 2008? 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Morning Session 



103 

A. Yes, sir. 

Q. And this was out in the smoking area outside the 
barracks at Fort Drum? 
A. Correct, sir. 

Q. Based upon those times that you spoke with PFC 
Manning, you recall him being interested in U.S. politics? 
A. Yes, sir. 

Q. And the way he talked, you got the impression that 
he was interested in going into politics? 
A. Not that I can remember, sir. 

Q. Do you recall telling me that based upon the way he 
talked you got the impression that he was interested in going 
into politics? 

A. Yes, sir. 

Q. And during those times that you spoke with him, he 
never said anything that gave you the impression that — 
MR. FEIN: Objection, Your Honor. Hearsay. 
THE COURT: Yes. 

MR. COOMBS: I'm not asking for a response. If I 
could finish my question, and then I think the objection may 
be appropriate to — 
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THE COURT: What is the question? 

MR . COOMBS : — make it at that point . 

During the times you spoke with him, he never gave 
you the impression that he held any anti-American positions . 

THE COURT: I'll allow that. Go ahead. 

THE WITNESS: No, sir. 
BY MR. COOMBS: 

Q. Now, you and PFC Manning both went to JRTC in 2009? 
A. Yes, sir. 

Q. And JRTC was the training that you received in 
preparation for deployment to Iraq? 
A. Yes, sir. 

Q. And at JRTC the two of you worked opposite shifts? 

A. Correct, sir. 

Q. You worked the night shift? 

A. Yes, sir. 

Q. And PFC Manning worked the day shift? 
A. Yes, sir. 

Q. And at JRTC, PFC Manning was in charge of working on 
the company's computers if there was any problems? 

A. I don't know if he was in charge of working on 
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computers, sir, but he may have worked on computers, yes. 

Q. All right. Well, you know he worked on the 
company's computers at JRTC? 

A. Yes, sir. 

Q. He unlocked some of the computer passwords for the 
S2 section? 

A. Not that I remember at this time, sir. I don't 
know. 

Q . Do you recall telling me that he unlocked — 
A. I don't remember. 

Q. Let me finish my question. Do you recall telling me 
that he unlocked some of the computer passwords at the S2 
section? 

A. I do not remember that, sir. 

Q. When you say you don't remember, are you saying I 
don't remember now because my memory is failing, or I don't 
remember because I don ' t think I ever said that to you? 

A. I don't remember it because memory is failing from 
that long ago, sir. 

Q. Okay. Now, the times in which he was working on the 
computers, did anyone to your memory go in and say, stop, 
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you're not permitted to do that? 
A. No, sir. 

Q. And he was very good at working on the computers, 
correct? 

A. Yes, sir. 

Q. And what type of computers did you work off as an 
analyst at JRTC? 

A. DCGS-A computers. 

Q. Now, in Iraq you also had DCGS-A computers, correct? 
A. Yes, sir. 

Q. And you're not really a computer guy, is that right? 
A. Correct. 

Q. You don't know much about computers beyond basically 
the basic operating system? 
A. Correct, sir. 

Q. But you knew that PFC Manning would occasionally 
work on the DCGS-A computers in Iraq? 
A. Possibly, sir. 

Q. Possibly meaning what? I'm sorry. 

A. It's possible that he did. I don't remember. 

Q. And I'm sorry to pin you down. Are you saying you 
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don't remember because so much time has gone by, or are you 
saying you don ' t remember because you don ' t believe he ever 
worked on the DCGS computers? 

A. So much time has gone by. 

Q. You don't recall that? 

A. I don't recall, yes. 

Q. Do you recall telling me that on the phone? 
A. No. 

Q. Do you recall telling me that you saw him go into 
the operating system and try to make the computer run faster? 
A. No, sir. 

Q. You don't recall telling me that? 
A. No, sir. 

Q. We talked a little over now about two and a half 
weeks ago. You don't recall telling me that at that point? 
A. I didn't talk to you about two and a half weeks ago, 

sir . 

Q. When's the last time you recall? 
A. It was probably about two years ago before the 
Article 32 hearing was the last time I recall talking to you . 
Q. That's the last time you recall talking to me? 
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A. Yes, sir. 

Q. Okay. Do you recall telling me that you witnessed 
him go into the task manager and change what programs are 
running and how they started? 

A. I'm not sure, sir. 

Q. Not sure meaning you don't recall that? 
A. I don't recall, sir. 

Q. Okay. Do you recall telling me that you witnessed 
him help others with their DCGS-A computers? 
A. Yes, sir. 

Q. All right. And we'll talk about that in a moment, 
but when he was helping others, no one stepped in and said, 
hey, you can't do that, that's not permitted? 

A. Correct, sir. 

Q. Now, you said your computer would crash 
occasionally? 

A. Yes, sir. 

Q. And sometimes I imagine when it crashed you lost 
information? 

A. Yes, sir. 

Q. So would you agree with me that analysts were 
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encouraged to save information on the T drive? 
A. Yes, sir. 

Q. And the T drive was the shared drive that everyone 
had access to? 

A. Yes, sir. 

Q. And analysts were also encouraged if they wanted to 
save information on a CD? 
A. Yes, sir. 

Q. And, of course, because it was your computer, your 
DCGS-A computer, you would save information on the desktop of 
your computer were if you wanted? 

A. Yes, sir. 

Q. That was permitted? 

A. Yes, sir. 

Q. Now, I want to talk about some of the times you 
witnessed others being helped by PFC Manning on the DCGS-A 
computer, okay? 

A. Yes, sir. 

Q. Now, the first time — well, actually one of the 
times was dealing with mIRC chat, is that correct? 
A. Yes, sir. 
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Q. And mIRC chat is one of those baseline programs that 
you didn't have on your DCGS-A computer, right? 
A. Correct, sir. 

Q. But analysts needed mIRC chat to do their job? 
A. Correct. 

Q . And that ' s because you as an analyst in the S2 
section would speak to others who were using mIRC chat? 
A. Correct. 

Q . So do you recall having PFC Manning set up mIRC chat 
on your computer? 
A. Yes, sir. 

Q. And do you recall him doing that for others? 
A. Yes, sir. 

Q. And mIRC chat, when you did that, it was put on your 
computer basically as something that you would double click 
to start on the desktop? 

A. Yes, sir. 

Q. And you're sure PFC Manning did this and not Mr. 
Millman? 

A. Yes, sir. 

Q. And when PFC Manning did this for you and others, 
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did anyone step in, to your memory, and say, hey, that's not 
permitted? 

A. No, sir. 

Q. Now, at Fort Drum you attended DCGS training with 
PFC Manning? 

A. Correct. 

Q. And do you recall who taught this training to you? 
A. I do not, sir. 

Q. Does MIT teams sound correct to you? 
A. Yes, sir, it would. 

Q. And do you recall what a MIT team was? 
A. No, I don't. 

Q. Did you ever receive any training on what you could 
and could not add on the desktop of your DCGS-A computer? 
A. Not that I recall. 

Q. And just for the judge, I want to make sure it's not 
that you recall, meaning I can't remember if we did, or I 
don ' t remember we ever did receive that training? 

A. Yeah. I don't remember, sir. 

Q. All right. Did you ever receive any training 
discussing what you could and could not place on your desktop 
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like mIRC chat, like an executable file? 
A. No , I do not . 

Q. And, again, is that you don't remember that, or you 
don't believe you received that training? 

A. I don't believe we received that training. 

Q. Okay. And during the deployment did anyone say to 
you that you could not put mIRC chat on your desktop as an 
executable file? 

A. No, they did not. 

Q. Did you receive any training either at Fort Drum or 
during the deployment on how you had to download information 
from the SIPRNET? 

A. Not that I remember, sir. 

Q. Was there any formal guidance or statement to you 
that you had to download information in one particular way, 
like click, open, save? 

A. No. 

Q. Do you know what exporting with Excel is? 
A. Yes, sir. 

Q. And could you tell the judge what that is? 

A. You'd take a document and export it into Excel, is 
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that the one you ' re — 
Q. Yes. 

A. And then it would make a sheet for you where it 
would list everything to like upload grid coordinates into an 
ARC map or something, for an example. 

Q. And when you were exporting large documents, say if 
you were exporting a month of SigActs to Excel, did you have 
to click, open and save every one of the SigActs or would the 
Excel export it for you? 

A. The Excel would export it for us. 

Q. So it would do it in an automated fashion, correct? 
A. Yes, sir. 

Q. Did anyone tell you that that was improper, that 
you're supposed to go and click, open and save and not use 
the automated process? 

A. No. 

Q. And from your memory, was that permitted? 
A. Yes, sir. 

Q. Now, you were a part of the advance party for Bravo 
company going to Iraq, is that right? 
A. Correct. 
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Q. And if I'm correct, you departed Fort Drum sometime 
in October of 2009? 
A. Yes, sir. 

Q. And then you arrived at FOB Hammer around the 15th 
of October? 

A. Yes, sir. 

Q. And when you arrived, you worked periodically in the 
SCIF, is that right? 
A . Right . 

Q. You also had to support your company's operations? 
A. Correct. 

Q. So initially you did not work full-time in the SCIF? 
A . That ' s correct . 

Q. And when you were in the SCIF, you worked as an 
intelligence analyst? 
A. Correct. 

Q. And I believe you said you were on the Shia threat 
group? 

A. Yes, sir. 

Q. And obviously PFC Manning was also on that? 
A. Yes. 
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Q . And at the start of the deployment you worked the 
day shift? 

A. Yes. 

Q. And PFC Manning worked the night shift? 
A. Yes, sir. 

Q. Now, on the night shift PFC Manning had certain 
tasks that he was, I guess had to complete, is that correct? 
A. Correct. 

Q. And he and the other night shift analysts were 
tasked to complete and update what I believe was called a 
commander's read book each night, is that right? 

A. Yes, that's correct. 

Q. And he also had to do a report slide that was due 
every night? 
A. Yes. 

Q. And for the slide PFC Manning and others had to do 
analysis? 

A. Correct. 

Q. And that slide was due every night at midnight? 
A. Yes, sir. 

Q. And these were products that he was required to 
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complete? 

A . That ' s correct . 

Q. Now, at any point when you were working in the 
T-SCIF, did they put out any formal training on the rules and 
regulations of the SCIF? 

A. Not that I recall, sir. 

Q. So when, and again, when you say not that you 
recall, meaning they could have and I don't remember it, or I 
don't believe they ever did that? 

A. They could have and I don't remember it. 

Q. From your memory, did you ever see soldiers 
listening to music in the SCIF? 

A. Yes. 

Q. And where was this music stored? 

A. It was stored on the T drive. 

Q. And that was a classified drive, correct? 

A. Correct. 

Q. Did you ever see the soldiers place that music on 
their DCGS-A computers? 

A. I didn't see them place it on the DCGS-A computers, 

no . 
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Q. Did you ever see the soldiers listening to the music 
on the DCGS-A computers? 
A. Yes, sir. 

Q. Did you ever see movies in the T-SCIF? 
A. Yes. 

Q. And did you ever see soldiers playing movies in the 
T-SCIF? 

A. Yes, sir. 

Q. Did you ever see video games Boeing played in the 
T-SCIF? 

A. Yes, sir. 

Q. And were these being played on the DCGS-A computer? 
A. Yes, sir. 

Q. And to your knowledge, was anyone ever punished for 
having movies, music or games in the T-SCIF? 
A. No. 

Q. And we talked about the fact that others had had 
mIRC chat added on to their desktop computer, right? 
A. Yes. 

Q. Was anyone ever punished for having mIRC chat put on 
their desktop? 
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A. No. 

Q. Did anyone ever say that that was wrong? 
A. No. 

MR . COOMBS : Thank you . 

THE COURT: Redirect? 

MR. WHYTE: Yes, ma'am. 

REDIRECT EXAMINATION 

BY MR. WHYTE: 

Q . Mr . Madaras , you said that PFC Manning helped other 
soldiers with their DCGS machines? 
A. Yes. 

Q. How did he help the other soldiers? 

A. From all I can remember was helping with mIRC chat. 

Q. And why was he asked to help the soldiers? 

A. Because we needed mIRC chat so we could talk to 
other unit at other FOBs . 

Q . So let ' s talk about mIRC chat . You said you had it 
on your DCGS machine? 

A. Yes, sir. 

Q. Where was it located on your machine? 
A. Right off the desktop. 
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Q. And who else had mIRC chat on their computer? 

A. Everybody did, sir. 

Q. In the S2 shop? 

A. Yes, sir. 

Q. What about outside? 

A. Anybody that worked in direct with us like current 
ops all had mIRC chat . 

Q. Can you explain to the court what mIRC chat look 
looks likes when you actually open it up? 

A. When you open it up there's a bunch of listings on 
the left side of the screen that has all the different chat 
groups in it . In the center it ' s a blank space so when you 
click to it it opens it up so you can see that group, and at 
the bottom is where you type in what you want to say. 

Q. And what type of information was communicated over 
mIRC chat? 

A. Mainly SigActs that was currently happening before 
they were actually published on the CPOF . 

Q. So why was this information communicated on the mIRC 
chat? 

A. Because the sooner we would know about stuff, the 
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more effect we could have on the battle you could say. 

Q. You said that mIRC chat was stored on the T drive, 
is that correct? 

A. Yes, sir. 

Q. Do you know when mIRC chat was put on the T drive? 

A. I don't. It was already on there from the previous 
unit when we got in country. 

Q. And then the defense asked you about the Excel 
export issue. Did CIDNE, the program itself, allow you to 
export SigActs? 

A. Yes, sir, you could then port them directly into 
Excel . 

Q. And also movies, music, games, that was also asked 
by the defense . Do you know when that information was put on 
the T drive? 

A. That was on the T drive from the previous unit. 
MR. WHYTE: No further questions, Your Honor. 
THE COURT: Go ahead. 
MR. COOMBS: Just one follow-up. 

RECROSS EXAMINATION 

BY MR. COOMBS: 
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Q. The DCGS-A computer, did anyone besides intelligence 
analysts have DCGS computers? 
A. I do not know, sir. 

Q. Were DCGS-A computers computers that were part of 
what you did as intelligence analysts? 
A. Yes, sir. 

Q. Would a person who didn't have a job that dealt with 
intelligence analysts be working off a DCGS-A computer? 
A. No, sir. 

MR . COOMBS : Thank you . 

THE COURT: Any last redirect? 

THE WITNESS: No, ma'am. 

THE COURT: Mr. Madaras, I have a few questions. 
The DCGS-A computers that were down range, you testified 
earlier there ' s a T drive and that T drive stored mIRC chat . 

THE WITNESS: Yes, ma'am. 

THE COURT: So the T drive was accessible to all 
users, but were your individual user drives or your user 
profiles accessible to your colleagues? 

THE WITNESS: If we saved them on to the T drive 
they were, ma'am. 
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THE COURT: So you said, you testified PFC Manning 
helped you install mIRC chat on your desktop. Was that as a 
shortcut from the T drive? 

THE WITNESS: That would be as a shortcut, ma'am, 
yes, from my understanding. 

THE COURT: Was there a separate mIRC chat on your 
user profile as well? 

THE WITNESS: I do not know. 

THE COURT: When you used mIRC chat, where did you 
use it from? 

THE WITNESS: Right off my desktop. 

THE COURT: You testified earlier that music, books 
and games were already on the T drive from the previous unit . 
Did any of the members of the SCIF, are you aware, did 
anybody put new movies, games or videos on the T drive? 

THE WITNESS: Not that I know of, no. 

THE COURT: Do you know if there was any 
authorization or prohibition from — any authorizing to do 
that, authorization to do that or prohibition against doing 
that? 

THE WITNESS: No, ma'am, I do not know. 
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THE COURT: So there was basically silence on the 

issue? 

THE WITNESS: Correct. 

THE COURT: Who supervised you? 

THE WITNESS: Kyle Balonek did. 

THE COURT: Would Mr. Balonek have been aware of 
people watching these movies and playing these games on the T 
drive . 

THE WITNESS: Yes, I would believe so. 

THE COURT: When you testified earlier that Mr. 
Millman I believe his name was would come and help you fix 
the computer problems that you had when you had them? 

THE WITNESS: Yes. 

THE COURT: Did — and he would re-image them. 
THE WITNESS: Yes, that's correct. 

THE COURT: When someone re-images a computer, what 
happens to the data that you have? 

THE WITNESS: From my understanding it gets rid of 
everything like starting fresh. 

THE COURT : Were you ever in a situation where you 
needed data from your computer before it was re-imaged? 
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THE WITNESS: Yes. 

THE COURT: What did you do with that data? 

THE WITNESS: We'd save it to a CD. 

THE COURT: And what would you do with the. CD? 

THE WITNESS : It would go into the computer again 
once he was done re-imaging it and re-save all the files to 
the computer that were needed, ma'am. 

THE COURT: Now, when the computer is re-imaged, 
does it strip data from the T drive, too? 

THE WITNESS : No . The T drive was a completely 
separate function. 

THE COURT: So the re-imaging would just be for your 
user profile? 

THE WITNESS: Just for the computer, thinking that 
was saved on that computer ' s hard drive . 

THE COURT: So the T drive is a shared drive located 
somewhere else? 

THE WITNESS: Correct. 

THE COURT: If the computers would go down 
frequently, why would you not save everything on the T drive? 
THE WITNESS : We usually tried to save most 
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everything that we were working on on the T drive, ma'am. 

THE COURT: You testified earlier that you didn't do 
any searches of Europe and Iceland and all of the other areas 
that you talked about because it wasn't in your particular 
area of operations. What's your understanding of, say you 
had down time, instead of watching a movie, you wanted to see 
what was going on in the world, for example . What is your 
understanding of what the policy, if any, was with respect to 
you searching things that didn ' t have anything to do with 
your AO? 

THE WITNESS : I don ' t believe there was any 
stipulation against doing so. 

THE COURT: Any questions based on my — 
MR. COOMBS: No, Your Honor. 
MR. FEIN: No, Your Honor. 

THE COURT : All right . Anything else for this 

witness? 

MR. WHYTE: No, ma'am. 

THE COURT: All right. Please don't discuss your 
testimony with anyone other than counsel and the accused 
while the trial is still going on . 
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All right. Counsel, I'm looking at the time, I'm 
also looking at stipulations of expected testimony that I 
have here . Would this be a good time to go through the 
stipulations of expected testimony with PFC Manning and then 
break for a lunch, or would you rather break for lunch and 
then go through it afterwards? 

MR. FEIN: Ma'am, the United States recommends that 
we break for lunch, for a two hour lunch recess because we 
have more stipulations and then we can put them all together 
at one time . 

THE COURT: Any objection to that? 

MR . COOMBS : No , ma ' am . 

THE COURT: Any. Court will reconvene at 1400 or 
two o ' clock . 

(LUNCH RECESS) 
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